CVE-2026-118192: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

Centereon SQL injection vulnerability

Centreon versions 25.10 through 25.10.15 and 24.10 through 24.10.28 contain an SQL injection vulnerability. This vulnerability arises from SQL injection, allowing authenticated users with ACL management privileges to read and modify the Centreon database...

PT-2026-132279

Subscriber SQL Injection in MLS On The Fly = 1.8.1.5 versions...

WordPress Newsmatic SQL injection vulnerability

WordPress Newsmatic versions 1.5.0 and earlier contain an SQL injection vulnerability. This vulnerability stems from insufficient escaping of user-supplied slug parameters and inadequate preparation of existing SQL queries. Unauthenticated attackers can exploit this parameter to append additional...

Favethemes MLS On The Fly SQL injection vulnerability

Favethemes MLS On The Fly versions 1.8.1.5 and earlier contain an SQL injection vulnerability, which is susceptible to SQL injection attacks...

CVE-2026-49142: openemr: OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that…

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the formicdcodes POST parameter to the...

PT-2026-130671

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...

PT-2026-132076

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2026-132085

Name of the Vulnerable Software and Affected Versions StylemixThemes Motors versions prior to 1.4.127 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection within the vehicle listings extension. This issue enables an attacker to execute...

PT-2026-130688

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

WordPress Motors SQL injection vulnerability

WordPress Motors versions 1.4.126 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...

CVE-2026-89216: Unknown vTables: The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL…

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

OpenEMR SQL injection vulnerability

Versions prior to OpenEMR 8.5.0 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the formicdcodes POST parameter submitted to the syndromicsurveillance/index endpoint within the Syndromic Surveillance module. It may allow users with Clinician-level...

CVE-2026-11587: Centreon: SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...

Radius Synergies Radius Xenia M2M Platform SQL injection vulnerability

The Radius Synergies Radius Xenia M2M Platform contains an SQL injection vulnerability. This vulnerability stems from insufficient input validation in the password recovery functionality within its web management interface. Unauthenticated remote attackers can supply specially crafted SQL queries...

CVE-2026-114358: Radius Synergies Radius Xenia M2M Platform: This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the…

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input...

CVE-2026-115965: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

PT-2026-130662

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

VulnCheck KEV: CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...